This vulnerability affects Oracle WebCenter Content: Imaging (component: Core) in versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical or all accessible data, as well as unauthorized modification (update, insert, delete) of some data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vendor advisory does not explicitly confirm a patch or remediation level for this vulnerability but strongly encourages applying available patches from the July 2026 Critical Patch Update.

An attacker with low privileges and network access via HTTP can gain unauthorized access to critical data or full access to all data accessible through WebCenter Content: Imaging. Additionally, the attacker may perform unauthorized data modifications including updates, inserts, or deletions on some data. This impacts confidentiality and integrity of the system's data. There is no indication of availability impact. No known exploits in the wild have been reported at the time of publication.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches without delay. Until an official patch is confirmed and applied, restrict network access to the affected WebCenter Content: Imaging instances to trusted users only and monitor for suspicious activity related to unauthorized data access or modification.